\section{CPU Details}
The 2A03 or 6502 CPU as it is more commonly known as has 56 instructions. 
Together with the numerous ways a memory location can be addressed it can execute 
a total of 151 operations. \cite{obelisk}  
Furthermore it has three 8-bit general purpose registers: \textit{accumulator} 
and \textit{index registers}. The remaining three registers are: 
\textit{stack pointer}, \textit{status register} and the 16-bit \textit{program 
counter} \cite{nesdoc}. Registers are very fast, small storage areas in the CPU, 
that are used for various computations and temporary storage.

\subsection{Instructions}
An instruction is indexed by its opcode, a hexadecimal value between 0x00 and 
0xFF. When executing instructions, the cpu fetches and decodes the opcode, and 
runs a specific instruction. Each instruction takes some number of cycles to 
execute, which is due to the internals in a CPU with bus, registers etc. For 
example, there can only be one value on the data bus at the same time.

The 56 instructions \cite{6502org} can be categorized into different groups as follows:
\begin{itemize}
    \item load/store - LDA, STA, TXS \ldots
    \item arithmetic/logic - ADC, ROLA, EOR \ldots
    \item branches/jumps - BEQ, BCC, JMP \ldots
    \item misc - SEC, BRK, CLI \ldots
\end{itemize}

\subsection{Status Register}
Status register or flag register holds the necessary state of the processor in 
between execution of instructions. This register holds 8 different flags where 
each flag is represented by one bit and the flags being set or cleared 
depending on instruction and its operands being executed. \\

\textit{Carry Flag} (C) - The \textit{carry} flag is used to detect overflow in 
unsigned arithmetic operations, for example adding 255 with 1 would result in 0 
since we are dealing with an 8-bit architecture, and the carry being set. So 
by using only one bit to represent overflow one can have support for calculations 
on numbers longer than 8-bits. \\

\textit{Zero Flag} (Z) - The \textit{zero} flag is set when the result of the 
last performed instruction was 0. It is often used when looping and branching while 
decrementing the accumulator, for example. \\

\textit{Interrupt Mask} (I) - When set the system will be prevented from 
executing interrupts though non maskable interrupts can not be disabled. \\

\textit{Decimal Mode} (D) - Used to switch the 6502 to \textit{binary coded decimal} 
(BCD) mode, however this is is not supported by the 2A03 so this flag is ignored. \\ 

\textit{Break Mode} (B) - The break flag is set when the \textit{break} (BRK) 
instruction has been executed causing a software interrupt to be generated. \\

\textit{Overflow Flag} (V) - The signed equivalent of the carry flag, meaning 
that a positive result was generated when a negative one was excepted and vice 
versa. For example adding 127 with 1 results in -128 and the overflow flag being 
set. \\

\textit{Negative Flag} (N) - Also known as the sign flag is used to represent 
the sign of the last calculation. This flag only mirrors the seventh bit of the 
result since that last bit tells if the number is positive (0) or negative (1). \\ 

\begin{figure}[h!]
    \begin{center}
        \includegraphics[width=150px]{images/status.png}
        \caption{The status register \cite{nesdoc}}
    \end{center}
\end{figure}

\section{Addressing Modes}
There are several different ways to access the data in memory that one wants to 
operate on, these are called addressing modes. Many instructions are able to 
operate using several of these modes, and the following modes exists: 
\cite{obelisk} \\ 

\textit{Implicit} - The data operated on is implied directly by the instruction. 
Used by instructions operating on the status register such as \textit{Set Carry Flag}
(SEC) for example. \\

\textit{Accumulator} - Used by instructions operating directly on the accumulator, 
e.g. \textit{Rotate Right Acc} (RORA). Very much like \textit{implicit} mode,
and internally treated the same. \\

\textit{Immediate} - Allows the programmer to specify an 8-bit literal directly 
following the instruction, such as \textit{Load Accumulator} (LDA \#255) \\

\textit{Zero Page} - A fast direct access mode that only can operate on the 
first page of memory from address 0 to 255 hence the name \textit{Zero Page}. 
Since only one byte, the least significant byte, is needed to access this area 
one extra cycle to fetch the most significant byte of the address is saved making 
the instructions that operate here faster. This also implies that the memory usage 
is minimized. Since the 2A03 has only a handful of usable registers code should 
utilize Zero Page addressing as much as possible. It is also possible to use 
indexed versions with X or Y register to offset the address, see 
\textit{Indexed Indirect} and \textit{Indirect Indexed} \\

\textit{Absolute} - The programmer supplies a 16-bit literal which is the absolute 
address operated on. The programmer may use indexed versions of this mode to offset 
the address using the X or Y register. \\

\textit{Relative} - This mode can only be used together with branches. 
The programmer supplies an 8-bit signed value, which is added to the 
\textit{program counter}. Thus, it is only possible to branch 128 bytes in 
memory in either direction. \\

\textit{Indirect} - Like the absolute mode, the programmer supplies a 16-bit 
address. However, when using indirect addressing, the contents of that address, 
and the address+1 is interpreted as an address, which is then used. The 2A03 has 
a wrapping bug concerning this addressing mode; when the address is xxFF, the 
first byte read will be at 0x23FF (for example), and the second byte will be 
read at 0x2300. Normally one would expect the byte to be read at 0x2400 
(0x23FF+1), but this is not the case here. \\

\textit{Indexed Indirect \& Indirect Indexed} - Both these modes operate on the 
zero page. The difference between them being what register is added as offset, 
and when it is added. The programmer supplies a one byte address pointing to the 
zero page which means that the address will be between 0 and 255. When using the 
indexed indirect mode, the contents of the X register is added to the address 
before it is read. When using indirect indexed, the contents of the Y register 
is added to the address after it is read. \\

\subsection{Memory Map}
The 2A03 is able to address up to 64KB memory due to the 16-bit addressing bus. 
However, the physical memory in the NES is no more than 2KB (addresses 0x0 to 0x800). 
Since the 2A03 uses memory mapped I/O, some addresses in logical memory are 
reserved for sound, PPU communication and DMA. Large parts of the logical memory 
are mirrored several times as well. \cite{nintech} \\

The \textit{first page} in memory (\textit{0x0-0xFF}) is called the zero page. 
The usage of the zero page is special, as many instructions support some of the 
zero page addressing modes to save memory and gain speed. \\

The \textit{second page} in memory (\textit{0x100-0x1FF}) is reserved for the stack. 
The stack can never grow bigger than this, but instead wraps around. Thus, if the 
stack pointer is at 0x1FF and a new value was pushed onto it, the stack pointer 
would be updated to 0x100. \\

The pages between \textit{0x200} and \textit{0x800} are used as regular RAM for 
storing variables like game data and such. All memory locations between 0x0 and 
0x800 are mirrored three times up to 0x2000. Thus, accessing 0x805 gives the
same result as accessing 0x05. \\

Addresses \textit{0x2000-0x2007} are memory mapped I/O registers used for 
communication between the CPU and PPU. These registers are mirrored every 8 
bytes up to 0x4000. \\

Addresses \textit{0x4000-0x4020} are used for sound, except for \textit{0x4014} 
which is used for DMA, and \textit{0x4016-0x4017} which are used for controller 
input. The addresses between \textit{0x4020} and \textit{0x6000} are used for 
expansion ROM; the area where memory mappers can swap in memory from cartridges. \\

Addresses \textit{0x6000-0x8000} are used to access save locations on cartridges. 
The only way for games to save states is by having a small RAM on the cartridge, 
powered by a battery. \\

All addresses from \textit{0x8000} and above contain the program ROM which is 
the game code divided into two banks. Some programs do not utilize more than one 
bank, and since \textit{0x8000-0xFFFF} contains two banks (16KB each) the other one 
starting at offset \textit{0xC000}, that program would be inserted into both banks by the 
system. \cite{nintech,nesdoc} \\

\begin{figure}[h!]
    \begin{center}
        \includegraphics[height=300px]{images/cpumap.png}
        \caption{The CPU memory map}
        \label{cpumap}
    \end{center}
\end{figure}

\newpage

\subsection{DMA}
Direct Memory Access is a technique using dedicated controller hardware, that 
enables transferring large pieces of data between the main memory and the PPU 
memory in an efficient manner bypassing the CPU altogether. In the NES this is 
used to transfer a large chunk of sprites from CPU RAM to \textit{Sprite RAM} 
(SPR-RAM) also known as \textit{OAM} in the PPU.\cite{hwman} \\

Activating DMA is done by writing one byte to \textit{0x4014}. This byte is 
multiplied by \textit{0x100} and is used as the base address from where data is read. 
The NES reads 256 bytes of data, and transfers them to the SPR-RAM of the PPU. 
The existing data in SPR-RAM is completely overwritten. The whole process takes 
512 cycles. Doing everything manually would require the programmer to write an 
SPR-RAM address to the PPU OAM address register, and then copy the desired byte 
from CPU RAM into SPR-RAM register. That would take 4 cycles for each byte. 
However, when DMA is occuring the data bus is busy, so the CPU can not execute 
any other instructions at that time. \cite{2A03tech}

\subsection{Memory Mapped I/O}

The CPU and PPU communicate via memory mapped I/O, on registers \textit{0x2000-0x2007}. 
For the CPU, this is a regular memory location, but internally it is mapped to a 
register in the PPU. The same technique is used when the CPU outputs sound to the 
APU, via registers \textit{0x4000-0x4020}. The addresses \textit{0x4016/0x4017} 
are the locations where information about input from the controllers is stored.
\cite{nesdoc, neswiki} \\

The internal structure of the controller mount point is a shift register. This 
means that data is shifted into the first bit once every read. Since one has the 
possibility of having both controller one and three connected to the same input, 
both are read from the same address. The NES controller has eight buttons which 
are read in the following order: \textit{A}, \textit{B}, \textit{Select}, 
\textit{Start}, \textit{Up}, \textit{Down}, \textit{Left}, \textit{Right}. 
To poll all information from a register it takes 24 reads, divided as follows 
(for 0x4016): 8 reads for P1, 8 reads for P3, 0, 1, B and after that 4 reads that 
does nothing. For the second controller, reads 17-19 is 1, 0, B instead. \cite{nesdoc} 
For each read, at most one bit is set (bit 0) for the controller input. However, 
when using other controllers such as the infamous NES zapper (light gun), other 
bits in the register indicate if the gun hit a sprite or not. Writing to the 
controller registers has no effect. \cite{nesdoc}

\subsection{Interrupts}
As the name implies interrupts are used to interrupt or prevent the normal 
sequential execution of code and make the processor jump to a predefined 
routine to execute some interrupt handling code. They are basically used to get 
the attention of the CPU for a short period of time and after that the regular 
execution is continued were the CPU was interrupted. For this to be transparent 
and the continuation of the execution possible a state needs to be saved before 
the execution of the interrupt and restored afterwards. For the 2A03, the program
counter and the status register is saved on the stack before executing the
interrupt handler. 

So called interrupt vectors are used to point to the location of the interrupt 
handling routines, starting at memory location 0xFFFA and stretching to the end 
of the memory map at 0xFFFF. \cite{progman,neswiki} \\
Interrupts can either be generated in hardware or software and NES has support 
for both. \\

\noindent The 6502 has three different interrupts: \\

\textit{NMI} - Non maskable interrupt is triggered by the PPU hardware after it 
has finished drawing a frame and is in a state called V-Blank, waiting for the 
TV hardware to retrace the cathod ray back to the top. This small time interval 
is the only time frame when the CPU can send data to the PPU memory without causing 
graphics corruption. It is heavily used in NES games to update SPR-RAM. The 
interrupt vector is located at \textit{0xFFFA} and \textit{0xFFFB}. \\

\textit{Reset} - Signaled when NES is powered on or the reset button has been 
pressed. It has its reset vector at \textit{0xFFFC} for the high byte of the address and 
\textit{0xFFFD} for the low byte. \\

\textit{IRQ} - Can be generated by memory mappers, or by the BRK instruction. 
An interrupt request is signaled, and interrupt vector is loaded from \textit{0xFFFE} 
and \textit{0xFFFF}. Interrupts generated by the BRK instruction are called 
\textit{software interrupts} and are mainly used for debugging purposes in the NES.
\cite{nesdoc}
